Email: 343 Autolearn: 0 AvgScore: 1.52 AvgScanTime: 1.80 sec Spam: 61 Autolearn: 0 AvgScore: 13.00 AvgScanTime: 1.75 sec Ham: 282 Autolearn: 0 AvgScore: -0.96 AvgScanTime: 1.81 sec Time Spent Running SA: 0.17 hours Time Spent Processing Spam: 0.03 hours Time Spent Processing Ham: 0.14 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 54 81.34 88.52 79.79 2 HTML_MESSAGE 54 69.39 88.52 65.25 3 DKIM_SIGNED 49 48.98 80.33 42.20 4 RELAYCOUNTRY_US 47 48.98 77.05 42.91 5 DCC_CHECK_NEGATIVE 42 78.72 68.85 80.85 6 XM_B_Unicode 42 60.93 68.85 59.22 7 DKIM_VALID 41 46.36 67.21 41.84 8 XM_DK_Pass 41 46.36 67.21 41.84 9 BAYES_50 38 54.81 62.30 53.19 10 FVGT_m_MULTI_ODD 31 28.86 50.82 24.11 11 XM_B_SpammyWords 30 23.91 49.18 18.44 12 XMListUnsubscribeExists 30 30.32 49.18 26.24 13 DKIM_VALID_AU 22 29.45 36.07 28.01 14 XM_B_Unicode3 21 35.28 34.43 35.46 15 LOC_TINY_FONT_1 21 19.53 34.43 16.31 16 XMSubLong 20 17.49 32.79 14.18 17 XM_Multi_Part_URI 19 16.62 31.15 13.48 18 DCC_CHECK 19 21.28 31.15 19.15 19 XM_B_Unsub 18 11.08 29.51 7.09 20 RELAYCOUNTRY_META 18 11.37 29.51 7.45 21 TR_XM_BayesUnsub 17 9.62 27.87 5.67 22 RCVD_IN_MSPIKE_H2 17 16.03 27.87 13.48 23 HTML_FONT_LOW_CONTRAST 17 23.62 27.87 22.70 24 MIME_HTML_ONLY 16 9.91 26.23 6.38 25 T_TM2_M_HEADER_IN_MSG 16 19.53 26.23 18.09 26 XM_DK_Undo_02 16 8.16 26.23 4.26 27 XM_B_SpammyWords2 14 10.79 22.95 8.16 28 T_KAM_HTML_FONT_INVALID 14 10.79 22.95 8.16 29 BOTNET 13 4.66 21.31 1.06 30 BOTNET_IPINHOSTNAME 12 5.83 19.67 2.84 31 DKIM_VALID_EF 12 23.91 19.67 24.82 32 BAYES_99 12 21.87 19.67 22.34 33 RCVD_IN_MSPIKE_WL 11 19.24 18.03 19.50 34 UNTRUSTED_Relay 11 7.00 18.03 4.61 35 BAYES_999 10 20.70 16.39 21.63 36 TR_XM_SpammyRelay 10 5.83 16.39 3.55 37 UNPARSEABLE_RELAY 9 12.24 14.75 11.70 38 XM_UncommonTLD01 9 6.41 14.75 4.61 39 TooManyTo_001 9 7.00 14.75 5.32 40 LOTS_OF_MONEY 9 3.79 14.75 1.42 41 DKIM_INVALID 8 2.62 13.11 0.35 42 XM_B_SpammyTLD 8 4.66 13.11 2.84 43 XM_UB50 7 4.08 11.48 2.48 44 XM_Body_Dirty_Words 6 4.66 9.84 3.55 45 XM_B_Phish_Phrases 6 3.50 9.84 2.13 46 TM2_M_VERY_LONG_WORD 6 2.33 9.84 0.71 47 BAYES_60 6 7.58 9.84 7.09 48 TR_XM_SpammyWords5 6 3.21 9.84 1.77 49 TR_XM_PHPDW 5 3.21 8.20 2.13 50 RELAYCOUNTRY_IN 5 2.04 8.20 0.71 51 TR_XM_DK_Unsub 5 11.37 8.20 12.06 52 XM_H_PHPOS 5 3.21 8.20 2.13 53 TR_XM_PHPForged 5 3.21 8.20 2.13 54 TooManyTo_002 5 2.92 8.20 1.77 55 TR_XM_InvalidRelay 5 1.46 8.20 0.00 56 RELAYCOUNTRY_CN 5 1.46 8.20 0.00 57 TooManyTo_003 5 2.33 8.20 1.06 58 TR_XM_SpammyWords4 5 2.04 8.20 0.71 59 TR_XM_NoHeaderRelay 5 1.75 8.20 0.35 60 HTML_IMAGE_RATIO_08 5 2.62 8.20 1.42 61 RCVD_IN_MSPIKE_H4 5 4.66 8.20 3.90 62 TooManyTo_004 5 1.75 8.20 0.35 63 TR_XM_FormFill2 5 3.21 8.20 2.13 64 XM_H_Long_From01 5 4.08 8.20 3.19 65 XMGappySubj_01 5 2.62 8.20 1.42 66 BAYES_80 4 2.92 6.56 2.13 67 ANY_BOUNCE_MESSAGE 4 34.69 6.56 40.78 68 TR_XM_SPAMCOP 4 1.17 6.56 0.00 69 RCVD_IN_MSPIKE_H5 4 9.62 6.56 10.28 70 T_TooManySym_01 4 5.25 6.56 4.96 71 XMNumbers 4 4.08 6.56 3.55 72 SpammyFromTLD_02 4 1.17 6.56 0.00 73 SpammyFromTLD_01 4 1.46 6.56 0.35 74 TR_XM_SpammyWords2 4 1.17 6.56 0.00 75 BOUNCE_MESSAGE 4 34.69 6.56 40.78 76 XMBounce_01 4 1.17 6.56 0.00 77 XMCapTrack 4 1.46 6.56 0.35 78 RCVD_IN_BL_SPAMCOP_NET 4 1.17 6.56 0.00 79 TR_XM_DKIM_Undo 4 2.62 6.56 1.77 80 HTML_MIME_NO_HTML_TAG 4 1.75 6.56 0.71 81 TR_DCC_Bayes_99 4 1.46 6.56 0.35 82 DKIM_ADSP_NXDOMAIN 4 1.46 6.56 0.35 83 TooManyTo_005 4 1.46 6.56 0.35 84 MIME_QP_LONG_LINE 4 4.66 6.56 4.26 85 XM_SendGrid 3 2.04 4.92 1.42 86 TR_XM_RelayPhish 3 0.87 4.92 0.00 87 FVGT_m_MULTI_ODD_EMAIL 3 0.87 4.92 0.00 88 XMSubPhish11 3 1.75 4.92 1.06 89 T_XMDrugObfuBody_12 3 0.87 4.92 0.00 90 TR_XM_INV_DKIM 3 0.87 4.92 0.00 91 XM_ShortIntro_01 3 1.46 4.92 0.71 92 HTML_IMAGE_RATIO_02 3 4.66 4.92 4.61 93 XMSubMetaSx_00 3 2.33 4.92 1.77 94 XM_B_SpammyWords3 3 3.21 4.92 2.84 95 TR_XM_SB_Phish 3 1.75 4.92 1.06 96 XMSexyCombo_05 3 1.46 4.92 0.71 97 TR_XM_UnparsRelay 3 2.92 4.92 2.48 98 KHOP_HELO_FCRDNS 3 1.46 4.92 0.71 99 LotsOfNums_01 3 4.37 4.92 4.26 100 XMBody_17 2 0.87 3.28 0.35 101 XMDateMe_00 2 0.58 3.28 0.00 102 XM_B_Unsub2 2 1.46 3.28 1.06 103 TR_XM_Base64_C 2 0.58 3.28 0.00 104 TR_Mismatch_TLD_02 2 0.58 3.28 0.00 105 MIME_BASE64_TEXT 2 0.58 3.28 0.00 106 RCVD_IN_MSPIKE_H3 2 4.96 3.28 5.32 107 URIBL_DBL_SPAM 2 0.58 3.28 0.00 108 BOTNET_NORDNS 2 0.58 3.28 0.00 109 T_TooManySym_02 2 3.50 3.28 3.55 110 MAILING_LIST_MULTI 2 1.17 3.28 0.71 111 XM_UB60 2 0.87 3.28 0.35 112 TR_XM_PhishingBody 2 1.17 3.28 0.71 113 FROM_GOV_DKIM_AU 2 0.87 3.28 0.35 114 XM_Evil_Numbers_Gen 2 1.75 3.28 1.42 115 XMSubLongNoVowel 2 0.58 3.28 0.00 116 XM_H_PHPOS_M 2 2.33 3.28 2.13 117 TR_XM_Base64_M1 2 0.58 3.28 0.00 118 MPART_ALT_DIFF 2 2.92 3.28 2.84 119 XM_DIRTYINTL 2 0.58 3.28 0.00 120 MPART_ALT_DIFF_COUNT 2 1.17 3.28 0.71 121 HTML_FONT_TINY_NORDNS 2 0.58 3.28 0.00 122 XM_B_Crypto 2 0.87 3.28 0.35 123 HTTPS_HTTP_MISMATCH 2 0.58 3.28 0.00 124 XM_H_PHPMailer 2 0.87 3.28 0.35 125 XM_B_Investor 2 0.87 3.28 0.35 126 DRUGS_ERECTILE 2 0.58 3.28 0.00 127 XM_Lotto 2 0.87 3.28 0.35 128 XM_SPF_SoftFail 2 2.04 3.28 1.77 129 TR_XM_Crypto3 2 0.58 3.28 0.00 130 AD_PREFS 2 0.58 3.28 0.00 131 XMSubNoVowel 2 1.46 3.28 1.06 132 HTML_TAG_BALANCE_HEAD 2 0.58 3.28 0.00 133 TR_XM_Base64_L1 2 0.58 3.28 0.00 134 RELAYCOUNTRY_PL 2 0.58 3.28 0.00 135 HTML_IMAGE_RATIO_06 2 0.87 3.28 0.35 136 FSL_BULK_SIG 2 12.24 3.28 14.18 137 STY_INVIS_DIRECT 1 0.58 1.64 0.35 138 FROM_SUSPICIOUS_NTLD 1 0.29 1.64 0.00 139 XM_TLDProd2 1 0.29 1.64 0.00 140 DKIM_ADSP_CUSTOM_MED 1 0.29 1.64 0.00 141 TR_XM_BayesRelay 1 0.29 1.64 0.00 142 T_Symld_Words_02 1 0.29 1.64 0.00 143 BAYES_40 1 2.92 1.64 3.19 144 XMSpoofStaff2 1 1.17 1.64 1.06 145 XM_UB80 1 0.29 1.64 0.00 146 URIBL_BLACK 1 0.29 1.64 0.00 147 DATE_IN_PAST_12_24 1 0.29 1.64 0.00 148 XMGenDplmaNmb 1 0.29 1.64 0.00 149 XMReplyNow 1 0.29 1.64 0.00 150 XMSubject_72 1 0.29 1.64 0.00 151 TO_NO_BRKTS_MSFT 1 0.29 1.64 0.00 152 TVD_RCVD_IP 1 1.75 1.64 1.77 153 XMStockSpam_01 1 0.29 1.64 0.00 154 HELO_NODOT 1 0.29 1.64 0.00 155 XM_H_SpoofStaff4 1 1.17 1.64 1.06 156 HTML_FONT_SIZE_LARGE 1 0.29 1.64 0.00 157 SUBJ_ALL_CAPS 1 1.17 1.64 1.06 158 URIBL_DBL_ABUSE_SPAM 1 0.29 1.64 0.00 159 OBFU_TEXT_ATTACH 1 0.29 1.64 0.00 160 HK_RANDOM_FROM 1 0.87 1.64 0.71 161 FROM_EXCESS_BASE64 1 0.58 1.64 0.35 162 XMDiploma_00 1 0.29 1.64 0.00 163 XM_B_SpammyTLD2 1 0.29 1.64 0.00 164 HELO_NO_DOMAIN 1 0.29 1.64 0.00 165 ALL_TRUSTED 1 41.40 1.64 50.00 166 DRUG_ED_SILD 1 0.29 1.64 0.00 167 RELAYCOUNTRY_CI 1 0.29 1.64 0.00 168 NO_DNS_FOR_FROM 1 0.87 1.64 0.71 169 HTML_IMAGE_RATIO_04 1 2.33 1.64 2.48 170 T_XMDrugObfuBody_00 1 0.58 1.64 0.35 171 TR_XM_PSC1 1 1.17 1.64 1.06 172 XMSubject_60 1 1.75 1.64 1.77 173 RELAYCOUNTRY_FI 1 0.29 1.64 0.00 174 PHP_SCRIPT 1 0.29 1.64 0.00 175 TR_XM_DK_SendGrid 1 0.58 1.64 0.35 176 XMGappySubj_02 1 0.87 1.64 0.71 177 FSL_HELO_NON_FQDN_1 1 0.29 1.64 0.00 178 RDNS_DYNAMIC 1 0.58 1.64 0.35 179 RCVD_IN_PSBL 1 0.29 1.64 0.00 180 RELAYCOUNTRY_DE 1 1.46 1.64 1.42 181 NML_ADSP_CUSTOM_MED 1 0.29 1.64 0.00 182 RCVD_IN_VALIDITY_SAFE 1 0.87 1.64 0.71 183 XM_B_SpammyWords4 1 0.29 1.64 0.00 184 XM_Dr_From 1 1.46 1.64 1.42 185 XMPhish14 1 0.58 1.64 0.35 186 TR_XM_MaxWHORU 1 0.29 1.64 0.00 187 HTML_IMAGE_ONLY_32 1 0.87 1.64 0.71 188 RELAYCOUNTRY_AT 1 0.87 1.64 0.71 189 TM2_M_URI_OPT_OUT 1 1.75 1.64 1.77 190 RCVD_IN_VALIDITY_CERTIFIED 1 0.58 1.64 0.35 191 TR_LOTS_OF_MONEY2 1 0.29 1.64 0.00 192 XMPhish11 1 0.29 1.64 0.00 193 XM_B_SexDrugs1 1 0.29 1.64 0.00 194 T_XMDrugObfuBody_14 1 0.87 1.64 0.71 195 DRUGS_ANXIETY 1 0.29 1.64 0.00 196 XMSubPhish3 1 0.29 1.64 0.00 197 TR_Mismatch_TLD_01 1 0.29 1.64 0.00 198 TR_XM_SpoofStaff2 1 0.29 1.64 0.00 199 HDRS_MISSP 1 0.29 1.64 0.00 200 XMBSHREFv2 1 1.17 1.64 1.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 228 78.72 68.85 80.85 2 T_SCC_BODY_TEXT_LINE 225 81.34 88.52 79.79 3 HTML_MESSAGE 184 69.39 88.52 65.25 4 XM_B_Unicode 167 60.93 68.85 59.22 5 BAYES_50 150 54.81 62.30 53.19 6 ALL_TRUSTED 141 41.40 1.64 50.00 7 RELAYCOUNTRY_US 121 48.98 77.05 42.91 8 DKIM_SIGNED 119 48.98 80.33 42.20 9 XM_DK_Pass 118 46.36 67.21 41.84 10 DKIM_VALID 118 46.36 67.21 41.84 11 BOUNCE_MESSAGE 115 34.69 6.56 40.78 12 ANY_BOUNCE_MESSAGE 115 34.69 6.56 40.78 13 XM_B_Unicode3 100 35.28 34.43 35.46 14 DKIM_VALID_AU 79 29.45 36.07 28.01 15 XMListUnsubscribeExists 74 30.32 49.18 26.24 16 DKIM_VALID_EF 70 23.91 19.67 24.82 17 FVGT_m_MULTI_ODD 68 28.86 50.82 24.11 18 HTML_FONT_LOW_CONTRAST 64 23.62 27.87 22.70 19 BAYES_99 63 21.87 19.67 22.34 20 BAYES_999 61 20.70 16.39 21.63 21 RCVD_IN_MSPIKE_WL 55 19.24 18.03 19.50 22 DCC_CHECK 54 21.28 31.15 19.15 23 XM_B_SpammyWords 52 23.91 49.18 18.44 24 T_TM2_M_HEADER_IN_MSG 51 19.53 26.23 18.09 25 LOC_TINY_FONT_1 46 19.53 34.43 16.31 26 FSL_BULK_SIG 40 12.24 3.28 14.18 27 XMSubLong 40 17.49 32.79 14.18 28 SCC_BODY_URI_ONLY 39 11.37 0.00 13.83 29 XM_Multi_Part_URI 38 16.62 31.15 13.48 30 RCVD_IN_MSPIKE_H2 38 16.03 27.87 13.48 31 TR_XM_DK_Unsub 34 11.37 8.20 12.06 32 UNPARSEABLE_RELAY 33 12.24 14.75 11.70 33 RCVD_IN_MSPIKE_H5 29 9.62 6.56 10.28 34 T_KAM_HTML_FONT_INVALID 23 10.79 22.95 8.16 35 XM_B_SpammyWords2 23 10.79 22.95 8.16 36 RELAYCOUNTRY_META 21 11.37 29.51 7.45 37 XM_B_Unsub 20 11.08 29.51 7.09 38 BAYES_60 20 7.58 9.84 7.09 39 T_XMDrugObfuBody_08 19 5.54 0.00 6.74 40 MIME_HTML_ONLY 18 9.91 26.23 6.38 41 BAYES_00 16 4.66 0.00 5.67 42 TR_XM_BayesUnsub 16 9.62 27.87 5.67 43 XM_DKIMWhitelistDomains 15 4.37 0.00 5.32 44 RCVD_IN_MSPIKE_H3 15 4.96 3.28 5.32 45 TooManyTo_001 15 7.00 14.75 5.32 46 T_TooManySym_01 14 5.25 6.56 4.96 47 BAYES_20 13 3.79 0.00 4.61 48 UNTRUSTED_Relay 13 7.00 18.03 4.61 49 HTML_IMAGE_RATIO_02 13 4.66 4.92 4.61 50 IN_ZIMBRA_NJ_WHITELIST 13 3.79 0.00 4.61 51 XM_UncommonTLD01 13 6.41 14.75 4.61 52 LotsOfNums_01 12 4.37 4.92 4.26 53 MIME_QP_LONG_LINE 12 4.66 6.56 4.26 54 XM_DK_Undo_02 12 8.16 26.23 4.26 55 MIME_HTML_MOSTLY 12 3.79 1.64 4.26 56 RCVD_IN_MSPIKE_H4 11 4.66 8.20 3.90 57 TO_MALFORMED 11 3.21 0.00 3.90 58 INVALID_MSGID 11 3.50 1.64 3.90 59 TR_XM_SpammyRelay 10 5.83 16.39 3.55 60 XMNumbers 10 4.08 6.56 3.55 61 XM_Body_Dirty_Words 10 4.66 9.84 3.55 62 T_TooManySym_02 10 3.50 3.28 3.55 63 BAYES_40 9 2.92 1.64 3.19 64 TR_XM_DK_Bayes1 9 2.62 0.00 3.19 65 XM_H_Long_From01 9 4.08 8.20 3.19 66 TR_XM_DK_Bayes 9 2.62 0.00 3.19 67 MPART_ALT_DIFF 8 2.92 3.28 2.84 68 BOTNET_IPINHOSTNAME 8 5.83 19.67 2.84 69 XM_B_SpammyTLD 8 4.66 13.11 2.84 70 XM_B_SpammyWords3 8 3.21 4.92 2.84 71 XMLngstWrd_00 8 2.62 1.64 2.84 72 HTML_IMAGE_RATIO_04 7 2.33 1.64 2.48 73 XM_UB50 7 4.08 11.48 2.48 74 XMStrtUSub 7 2.33 1.64 2.48 75 RELAYCOUNTRY_AU 7 2.33 1.64 2.48 76 TR_XM_UnparsRelay 7 2.92 4.92 2.48 77 TR_XM_DK_Bayes2 6 1.75 0.00 2.13 78 XM_H_PHPOS_M 6 2.33 3.28 2.13 79 TR_XM_PHPForged 6 3.21 8.20 2.13 80 XM_H_PHPOS 6 3.21 8.20 2.13 81 MSGID_NOFQDN1 6 1.75 0.00 2.13 82 BAYES_80 6 2.92 6.56 2.13 83 TR_XM_PHPDW 6 3.21 8.20 2.13 84 TR_XM_FormFill2 6 3.21 8.20 2.13 85 USER_IN_WHITELIST 6 1.75 0.00 2.13 86 USER_IN_WELCOMELIST 6 1.75 0.00 2.13 87 XM_B_Phish_Phrases 6 3.50 9.84 2.13 88 TM2_M_URI_OPT_OUT 5 1.75 1.64 1.77 89 XMSubject_60 5 1.75 1.64 1.77 90 TVD_RCVD_IP 5 1.75 1.64 1.77 91 TR_XM_SpammyWords5 5 3.21 9.84 1.77 92 XM_SPF_SoftFail 5 2.04 3.28 1.77 93 TR_XM_DKIM_Undo 5 2.62 6.56 1.77 94 XMSubMetaSx_00 5 2.33 4.92 1.77 95 IN_HORDE_ADDRESS_BOOK 5 1.46 0.00 1.77 96 XM_ZIP 5 1.46 0.00 1.77 97 TooManyTo_002 5 2.92 8.20 1.77 98 XM_Evil_Numbers_Gen 4 1.75 3.28 1.42 99 XM_Dr_From 4 1.46 1.64 1.42 100 RELAYCOUNTRY_DE 4 1.46 1.64 1.42 101 RCVD_IN_IADB_DK 4 1.17 0.00 1.42 102 XM_SendGrid 4 2.04 4.92 1.42 103 RCVD_IN_RP_SAFE 4 1.17 0.00 1.42 104 TVD_SPACE_RATIO 4 1.17 0.00 1.42 105 RCVD_IN_IADB_SPF 4 1.17 0.00 1.42 106 HTML_IMAGE_RATIO_08 4 2.62 8.20 1.42 107 XMGappySubj_01 4 2.62 8.20 1.42 108 RCVD_IN_IADB_SENDERID 4 1.17 0.00 1.42 109 LOTS_OF_MONEY 4 3.79 14.75 1.42 110 RCVD_IN_RP_CERTIFIED 4 1.17 0.00 1.42 111 RCVD_IN_IADB_LISTED 4 1.17 0.00 1.42 112 TR_Symld_Words 3 0.87 0.00 1.06 113 XMSubPhish11 3 1.75 4.92 1.06 114 BOTNET 3 4.66 21.31 1.06 115 SUBJ_ALL_CAPS 3 1.17 1.64 1.06 116 XM_H_SpoofStaff4 3 1.17 1.64 1.06 117 TR_XM_PSC1 3 1.17 1.64 1.06 118 FROM_GOV_SPOOF 3 0.87 0.00 1.06 119 XMBody_95 3 0.87 0.00 1.06 120 NUMERIC_HTTP_ADDR 3 0.87 0.00 1.06 121 XMSpoofStaff2 3 1.17 1.64 1.06 122 XM_B_Unsub2 3 1.46 3.28 1.06 123 XMSubNoVowel 3 1.46 3.28 1.06 124 XMSubMetaSxObfu_03 3 0.87 0.00 1.06 125 BAYES_95 3 0.87 0.00 1.06 126 TR_XM_SpoofStaff 3 1.17 1.64 1.06 127 T_REMOTE_IMAGE 3 0.87 0.00 1.06 128 TR_XM_SB_Phish 3 1.75 4.92 1.06 129 XM_PDF 3 0.87 0.00 1.06 130 TooManyTo_003 3 2.33 8.20 1.06 131 XMLngstWrd_01 3 1.17 1.64 1.06 132 USER_IN_DEF_DKIM_WL 3 0.87 0.00 1.06 133 XMBSHREFv2 3 1.17 1.64 1.06 134 RCVD_IN_VALIDITY_SAFE 2 0.87 1.64 0.71 135 XMGappySubj_02 2 0.87 1.64 0.71 136 T_OBFU_PDF_ATTACH 2 0.58 0.00 0.71 137 MISSING_HEADERS 2 0.58 0.00 0.71 138 DATE_IN_PAST_06_12 2 0.58 0.00 0.71 139 RELAYCOUNTRY_AT 2 0.87 1.64 0.71 140 HTML_IMAGE_ONLY_32 2 0.87 1.64 0.71 141 MAILING_LIST_MULTI 2 1.17 3.28 0.71 142 HK_RANDOM_FROM 2 0.87 1.64 0.71 143 T_TooManySym_03 2 0.58 0.00 0.71 144 TR_XM_PhishingBody 2 1.17 3.28 0.71 145 BAYES_05 2 0.58 0.00 0.71 146 NO_DNS_FOR_FROM 2 0.87 1.64 0.71 147 XM_ZohoDesk1 2 0.58 0.00 0.71 148 SUBJ_BUY 2 0.58 0.00 0.71 149 RELAYCOUNTRY_IN 2 2.04 8.20 0.71 150 XM_CamelCaseFrm001 2 0.58 0.00 0.71 151 RELAYCOUNTRY_CZ 2 0.58 0.00 0.71 152 KHOP_HELO_FCRDNS 2 1.46 4.92 0.71 153 XM_Body_Obfu01 2 0.58 0.00 0.71 154 XMSexyCombo_05 2 1.46 4.92 0.71 155 TR_XM_SpammyWords4 2 2.04 8.20 0.71 156 TM2_M_VERY_LONG_WORD 2 2.33 9.84 0.71 157 XM_ShortIntro_01 2 1.46 4.92 0.71 158 HTML_MIME_NO_HTML_TAG 2 1.75 6.56 0.71 159 MPART_ALT_DIFF_COUNT 2 1.17 3.28 0.71 160 T_XMDrugObfuBody_14 2 0.87 1.64 0.71 161 HK_RANDOM_ENVFROM 2 0.87 1.64 0.71 162 T_FILL_THIS_FORM_SHORT 2 0.58 0.00 0.71 163 XMLngstWrd_02 2 0.87 1.64 0.71 164 TR_XM_SpoofPhishAttach 2 0.58 0.00 0.71 165 DKIM_INVALID 1 2.62 13.11 0.35 166 XMPhish14 1 0.58 1.64 0.35 167 TR_XM_COVIDMETA5 1 0.29 0.00 0.35 168 RDNS_DYNAMIC 1 0.58 1.64 0.35 169 TR_XM_DK_SendGrid 1 0.58 1.64 0.35 170 HTML_IMAGE_ONLY_08 1 0.29 0.00 0.35 171 SHOPIFY_IMG_NOT_RCVD_SFY 1 0.29 0.00 0.35 172 RCVD_IN_VALIDITY_CERTIFIED 1 0.58 1.64 0.35 173 DATE_IN_PAST_24_48 1 0.29 0.00 0.35 174 FROM_EXCESS_BASE64 1 0.58 1.64 0.35 175 RCVD_IN_IADB_OPTIN 1 0.29 0.00 0.35 176 XMSubMetaD_00 1 0.29 0.00 0.35 177 MY_SERVERS_FOUND 1 0.29 0.00 0.35 178 XM_H_Trusted_IP 1 0.29 0.00 0.35 179 FROM_GOV_DKIM_AU 1 0.87 3.28 0.35 180 T_XMDrugObfuBody_00 1 0.58 1.64 0.35 181 XMSexyCombo_01 1 0.29 0.00 0.35 182 SpammyFromTLD_01 1 1.46 6.56 0.35 183 WEIRD_PORT 1 0.29 0.00 0.35 184 XM_UB60 1 0.87 3.28 0.35 185 URI_TRUNCATED 1 0.29 0.00 0.35 186 RELAYCOUNTRY_NL 1 0.29 0.00 0.35 187 XMSubject_78 1 0.29 0.00 0.35 188 HTML_IMAGE_ONLY_20 1 0.29 0.00 0.35 189 TR_MetaPhish_Combo_01 1 0.29 0.00 0.35 190 XM_H_WindowsLiveMail 1 0.29 0.00 0.35 191 TVD_APPROVED 1 0.29 0.00 0.35 192 XMBody_17 1 0.87 3.28 0.35 193 STY_INVIS_DIRECT 1 0.58 1.64 0.35 194 XMBody_29 1 0.29 0.00 0.35 195 XM_GoogleGroups 1 0.29 0.00 0.35 196 XM_E_VN 1 0.29 0.00 0.35 197 CHARSET_FARAWAY_HEADER 1 0.29 0.00 0.35 198 XM_B_SEO 1 0.29 0.00 0.35 199 NORMAL_HTTP_TO_IP 1 0.29 0.00 0.35 200 RELAYCOUNTRY_KR 1 0.29 0.00 0.35 ----------------------------------------------------------------------